2022

A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application tha

IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they shou

IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed a

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending

IBM Application Gateway is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaSc

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to refl

A vulnerability was found in Sony PS4 and PS5. It has been classified as critical. This affects the function UVFAT_readu

In affected versions of Octopus Deploy it is possible to reveal the Space ID of spaces that the user does not have acces

The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized use

The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user

In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minim

Just like in the previous report, an attacker could steal the account of different users. But in this case, it's a littl

A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System. This affects an

Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthen

Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScri

Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An

Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special ch

Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit

Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privileg

Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A phys

Zammad 5.2.1 has a fine-grained permission model that allows to configure read-only access to tickets. However, agents w

Zammad 5.2.1 is vulnerable to Incorrect Access Control. Zammad's asset handling mechanism has logic to ensure that custo

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL poi

An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct

DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to in

Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template mo

ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using LLC/SNAP headers with invalid length

Layer 2 network filtering capabilities such as IPv6 RA guard can be bypassed using combinations of VLAN 0 headers, LLC/S

Layer 2 network filtering capabilities such as IPv6 RA guard or ARP inspection can be bypassed using combinations of VLA

Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register

Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Nam

Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an

Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote atta

Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potenti

Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to

Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a loca

Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an attacker who convin

Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had

Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convince

Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remo

An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to cr

A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability i

The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow

The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which c

The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users t